Privilege Escalation Vulnerability in School Management System by WordPress

CVE-2024-9658

What is CVE-2024-9658?

The School Management System for WordPress plugin is susceptible to a privilege escalation vulnerability affecting all versions up to and including 93.0.0. This flaw arises from insufficient validation of a user's identity when updating sensitive details such as email addresses and passwords. Specifically, the mj_smgt_update_user() and mj_smgt_add_admission() functions do not adequately authenticate users, allowing authenticated attackers—who have at least student-level access—to exploit this vulnerability. By doing so, they can change the email addresses and passwords of any user, including administrators, thereby gaining unauthorized access to their accounts. Despite prior outreach to address the issue, the vulnerability remains unpatched.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References